Fix leaks due to created popup annotations

core/fpdfdoc/cpdf_annotlist.cpp

 // Copyright 2016 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fpdfdoc/include/cpdf_annotlist.h"
 
 #include "core/fpdfapi/fpdf_page/include/cpdf_page.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_document.h"
@@ skipping 10 matching lines @@
 std::unique_ptr<CPDF_Annot> CreatePopupAnnot(CPDF_Annot* pAnnot,
                                              CPDF_Document* pDocument) {
   CPDF_Dictionary* pParentDict = pAnnot->GetAnnotDict();
   if (!pParentDict)
     return std::unique_ptr<CPDF_Annot>();
 
   CFX_ByteString sContents = pParentDict->GetStringBy("Contents");
   if (sContents.IsEmpty())
     return std::unique_ptr<CPDF_Annot>();
 
   CPDF_Dictionary* pAnnotDict = new CPDF_Dictionary;

[Lei Zhang, 2016/09/01 03:53:12]

Alternatively, we can have some other container to hold these objects, and tie
the lifetime of the container to the lifetime of |pPopupAnnot|. That way we
won't have to modify CPDF_Annot at all.

[Wei Li, 2016/09/01 19:08:34]

I know the current solution is not ideal. But maintaining a separate container
as well as the mapping between <popupAnnot, popupAnnotDict> is too much and
confusing. I tried to use a vector in CPDF_AnnotList to store the dict list. But
the use and release an individual Annotation is all over the place. :(

   pAnnotDict->SetAtName("Type", "Annot");
   pAnnotDict->SetAtName("Subtype", "Popup");
   pAnnotDict->SetAtString("T", pParentDict->GetStringBy("T"));
   pAnnotDict->SetAtString("Contents", sContents);
 
   CFX_FloatRect rect = pParentDict->GetRectBy("Rect");
   rect.Normalize();
   CFX_FloatRect popupRect(0, 0, 200, 200);
   popupRect.Translate(rect.left, rect.bottom - popupRect.Height());
 
   pAnnotDict->SetAtRect("Rect", popupRect);
   pAnnotDict->SetAtInteger("F", 0);
 
   std::unique_ptr<CPDF_Annot> pPopupAnnot(
-      new CPDF_Annot(pAnnotDict, pDocument));
+      new CPDF_Annot(pAnnotDict, pDocument, true));
   pAnnot->SetPopupAnnot(pPopupAnnot.get());
   return pPopupAnnot;
 }
 
 }  // namespace
 
 CPDF_AnnotList::CPDF_AnnotList(CPDF_Page* pPage)
     : m_pDocument(pPage->m_pDocument) {
   if (!pPage->m_pFormDict)
     return;
@@ skipping 10 matching lines @@
     CPDF_Dictionary* pDict = ToDictionary(pAnnots->GetDirectObjectAt(i));
     if (!pDict)
       continue;
 
     uint32_t dwObjNum = pDict->GetObjNum();
     if (dwObjNum == 0) {
       dwObjNum = m_pDocument->AddIndirectObject(pDict);
       CPDF_Reference* pAction = new CPDF_Reference(m_pDocument, dwObjNum);
       pAnnots->InsertAt(i, pAction);
       pAnnots->RemoveAt(i + 1);
       pDict = pAnnots->GetDictAt(i);

[dsinclair, 2016/08/31 20:28:31]

Could we clone the dictionary at this point and pass a std::unique_ptr into
CPDF_Annot constructor so it's always owned?

Do we have any idea how big this dictionary can be?

     }
 
     // Skip creating Popup annotation in the PDF document since PDFium provides
     // its own Popup annotations.
     if (pDict->GetStringBy("Subtype") == "Popup")
       continue;
 
     m_AnnotList.push_back(
-        std::unique_ptr<CPDF_Annot>(new CPDF_Annot(pDict, m_pDocument)));
+        std::unique_ptr<CPDF_Annot>(new CPDF_Annot(pDict, m_pDocument, false)));
     if (bRegenerateAP && pDict->GetStringBy("Subtype") == "Widget" &&
         CPDF_InterForm::IsUpdateAPEnabled()) {
       FPDF_GenerateAP(m_pDocument, pDict);
     }
   }
 
   size_t nAnnotListSize = m_AnnotList.size();
   for (size_t i = 0; i < nAnnotListSize; ++i) {
     std::unique_ptr<CPDF_Annot> pPopupAnnot(
         CreatePopupAnnot(m_AnnotList[i].get(), m_pDocument));
@@ skipping 76 matching lines @@
                                    CPDF_RenderContext* pContext,
                                    FX_BOOL bPrinting,
                                    CFX_Matrix* pMatrix,
                                    FX_BOOL bShowWidget,
                                    CPDF_RenderOptions* pOptions) {
   uint32_t dwAnnotFlags = bShowWidget ? ANNOTFLAG_INVISIBLE | ANNOTFLAG_HIDDEN
                                       : ANNOTFLAG_INVISIBLE;
   DisplayAnnots(pPage, nullptr, pContext, bPrinting, pMatrix, dwAnnotFlags,
                 pOptions, nullptr);
 }